025ca9a56a4ab20702dd386fef1d2df311646fb741841cc64d70d37f84468876

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:31

Target

DriverInstall/360NetUL.dll
Size

214KB
MD5

4afd7f64c5a9c99c2fc12c64c9177e2b
SHA1

620a367b44547dbfb83f5a781531545a5c2ada30
SHA256

ef08600a8e6f5af979cd2ed189a90dafc69ed0aa2076e9f170b7a8ba9a67a24f
SHA512

4b2b7b80f85aaa5925fa97c6eb9ad3478c7fed967723ffcf32d2b40351d8fddcc30eb8ac606c8a97d2ccbecb97fe92dea39910fc712e2bd25820837f3b4be7c2
SSDEEP

3072:jhK5KbGN4Y+9jjqKXBTi6B8+k8//uLSCKqwYycmfdhawYo9TBf9P4yA5JXtvb:VK5KbGFKXBkN8/MSC6Bvhaxo9TBFP+db

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2984 wrote to memory of 2928	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2928	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2928	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2928	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2928	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2928	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2928	2984	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverInstall\360NetUL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverInstall\360NetUL.dll,#1
2⤵
PID:2928